236 reputation
29
bio website anfedorov.com
location New York, NY
age 29
visits member for 3 years, 1 month
seen yesterday

Jul
26
awarded  Commentator
Jul
26
comment Can an individual get an extended validation certificate?
Maybe I misunderstood. I think you said there is no 3.2.3 in the 2013 version. So the verification applies to the person submitting the application, not the entity being verified?
Jul
24
comment Does SSH password authentication provide the server with the password?
Thanks, Jeff. Could you post this as an answer so that I can accept it?
Jul
24
revised Does SSH password authentication provide the server with the password?
deleted 158 characters in body
Jul
24
awarded  Yearling
Jul
24
awarded  Editor
Jul
24
awarded  Teacher
Jul
24
comment Does SSH password authentication provide the server with the password?
Updated it again with an alternative suggestion. I'm not sure if I'm qualified to suggest secure schemes, it just seems to me like a solvable problem.
Jul
24
revised Does SSH password authentication provide the server with the password?
updated with hypothetical protocol
Jul
24
comment Does SSH password authentication provide the server with the password?
Good call! I've generalized the question to not propose a particular algorithm. I'm thinking of something along the lines of Socialist Millionaire, but with one party holding a salted hash of the password.
Jul
24
revised Does SSH password authentication provide the server with the password?
added 3 characters in body
Jul
24
comment Does SSH password authentication provide the server with the password?
Someone pointed out in the comments that this would be impossible to validate unless the server has the password in plaintext, so I updated the question.
Jul
23
revised Does SSH password authentication provide the server with the password?
added 60 characters in body
Jul
23
comment Does SSH password authentication provide the server with the password?
I'm not suggesting we send the hash of the password, but rather the hash of the password and two nonces - one created by the server and the other by the client. This prevents modifying the daemon code to record your password on attempts. Having a chance to brute force the authentication store is not the same as having done it successfully and having recovered a password.
Jul
23
asked Does SSH password authentication provide the server with the password?
Jul
22
comment Why does COMODO have 5 root certificates on a new Apple laptop?
That seems silly. How is it possible for four of them to be hacked and not the fifth? Why not just take all five and use them to encrypt a "super secure" one that you actually give to Apple to ship?
Jul
22
revised Why does COMODO have 5 root certificates on a new Apple laptop?
remove the part of question answered in comments
Jul
22
revised Could I ever be legally required to decrpyt user information?
added 16 characters in body
Jul
22
revised Could I ever be legally required to decrpyt user information?
added 1165 characters in body
Jul
21
answered Could I ever be legally required to decrpyt user information?